Improper Neutralization of Null Byte or NUL Character

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character via the shell.openPath function. An attacker can bypass file path...

Server-side Request Forgery (SSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path in the Repo.archive. An attacker can access arbitrary files on the filesystem by supplying specially crafted options that are not...

External Control of File Name or Path

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to External Control of File Name or Path via the forwarding of unguarded options in the checkout and create functions. An attacker can overwrite arbitrary files or read...

Malicious Package

Overview pfp-forms-mobile-sme-group-tiles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview croft-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview binproto is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @hornetsecurity/angular-search-box is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview metavu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via THeaderTransport::readString in the header parsing path. An attacker can trigger the flaw by sending a crafted THeader frame with an info-header string length that exceeds the bytes remaining in the header section...

Malicious Package

Overview @sqlite-frame/createsql is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview express-self-destruct is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the updateUser process of the API endpoint, which fails to enforce proper authorization checks for editing superuser accounts and changing user passwords. An attacker can gain full administrative access by sendi...

Use of Cache Containing Sensitive Information

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the getallmodels process due to improper cache key configuration, which causes permission-filtered model lists to be shared across users. An attacker can acces...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization in the processuploadedfile process. An attacker can modify the file membership of a knowledge base without proper authorization by supplying a crafted metadata.knowledgeid value during...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the executeautomation process and the model access control logic. An attacker can continue to execute scheduled automations and consume operator resources by leveraging a...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through inefficient route matching in the manifest endpoint. An attacker can cause excessive server load and degrade response times by sending unauthenticated targeted requests. Note: This is only...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the tdscparsetdsf function. An attacker can achieve heap corruption and potentially execute arbitrary code by supplying a crafted AVI file that manipulates frame dimensions across TDSF frames, leading tdscblit and...

Malicious Package

Overview chai-as-stringify is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

Prototype Pollution

Overview n8n-core is a Core functionality of n8n Affected versions of this package are vulnerable to Prototype Pollution in the expression engine. An attacker can cause the application to become unresponsive or crash by manipulating array-element access to obtain a reference to a host built-in an...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in adxdecodeframe in libavcodec/adxdec.c. An attacker can trigger memory corruption or a crash by supplying a crafted ADX or AAX audio stream that delivers AVPKTDATANEWEXTRADATA mid-stream and changes the channel...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the runnodetool function in the agents module. An attacker can gain unauthorized access to credential secrets and execute arbitrary nodes by interacting with an agent that...

Insertion of Sensitive Information Into Sent Data

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via Git.polishurl in Repo.clonefrom and the stored-origin normalization path in git/repo/base.py. An attacker can mak...

Malicious Package

Overview web3-essential is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview s3-lambda-dynamodb-cdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @gocortexio/npmgremlinbox-artistic-1-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview zwxbclic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zzfadgivar13 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the message actions. An attacker can perform unauthorized actions by sending requests as a lower-trust user or through a configured input path when the feature is...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the device-pair approval. An attacker can perform unauthorized actions by exploiting misconfigured input paths when the affected feature is enabled and...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Malicious Package

Overview fhirproxy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview iwsdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Missing Authorization

Overview n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol MCP Affected versions of this package are vulnerable to Missing Authorization in the workflow version history process in multi-tenant HTTP deployments due to improper isolation of stored backups between...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the Files.php and Myfiles.php controllers, which insufficiently validate user-supplied paths by relying on prefix checks of the raw URL rather than resolving the canonical filesystem path. An attacker can access...

Cross-site Scripting (XSS)

Overview hfs is a HTTP File Server Affected versions of this package are vulnerable to Cross-site Scripting XSS through the basicWeb file-listing renderer in src/basicWeb.ts. An attacker can execute script in a victim’s browser by uploading a file with a malicious name and getting someone to open...

Malicious Package

Overview @gt-test-exp/profiler-exp-00000002 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview getd-pantallas-cliente is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Use After Free

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Authorization Bypass Through User-Controlled Key

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the assetid field in the API update process. An attacker can gain unauthorized access to assets outside their company...

External Control of File Name or Path

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via workflow credential handling in the workflow API and authentication guard code. An authenticated user with workflow:create permission can save, update, or import a crafted workflow that pollutes Object.prototype,...

Malicious Package

Overview myclaude-code is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Inefficient Algorithmic Complexity

Overview elysia is an Ergonomic Framework for Human Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the getAll function in form data normalization for multipart/form-data endpoints. An attacker can cause excessive CPU consumption by submitting a large...

Directory Traversal

Overview @appium/storage-plugin is a Server-side storage plugin for Appium Affected versions of this package are vulnerable to Directory Traversal via the POST /storage/delete handler, which passes user-supplied input directly into path.join and fs.rimraf without proper path sanitization. An...